Article 15 of the GDPR: Not a tool for commercial debt recovery

In its judgment of 24 February 2026 (VI ZR 430/24), the Federal Court of Justice (BGH) clarified that the right to access data under Article 15 of the GDPR remains with the data subject in the event of the purchase of a claim and does not pass to the purchaser as a subsidiary right analogous to Section 401 of the German Civil Code (BGB). The Federal Court of Justice did not rule on the question of the assignability of rights to information under Article 15 of the GDPR due to the specific circumstances of the case. 

Facts 

The business model of the claimant, a public limited company based in Switzerland, consists of having claims against their contractual partners assigned to it by consumers by way of the purchase of claims, in order to then assert these claims in its own name. In the case in question, it had concluded identical contracts in 2021 with six policyholders of a private health insurance scheme for the acquisition of claims for reimbursement and damages against the insurer on account of overpaid premiums. The claimant took the view that the insurer had invalidly increased its premiums on several occasions in the past. The contracts between the claimant and the policyholders contained the following provisions under the heading ‘Assignment and Authorisation’: 

“(a) By signing below, you assign to the Company all claims for reimbursement and damages arising in connection with overpaid premiums to the debtor, whether known or unknown, present, future or past. […]

(b) Furthermore, you authorise the Company, […] GmbH and […] Inkasso GmbH, each individually, to assert all claims for information and data transfer necessary for enforcement. At the same time, you hereby assign to the Company any claims for damages arising from the non-fulfilment of these claims.”

The contracts also contained, under the heading ‘Authorisation’ below, a subsidiary authorisation to enforce the ‘claims referred to above’ in the claimant’s own name.

On this basis, the claimant brought a staged action and initially sought information pursuant to Article 15 of the GDPR regarding premium income, active tariffs and premium increases implemented, in order to subsequently have the invalidity of individual premium adjustments established and to quantify claims for repayment. In doing so, it relied on three approaches: firstly, it invoked a contractual assignment of the right to information; secondly, an automatic transfer of the right to information as a subsidiary right analogous to Section 401 of the German Civil Code (BGB); and thirdly, in the alternative, a voluntary representative action. The Regional Court of Münster dismissed the claim; the Higher Regional Court of Hamm upheld this decision and allowed an appeal to the Federal Court of Justice (BGH) in order to clarify the hitherto unresolved question of the assignability of rights to information under Article 15 of the GDPR. 

Rights to information were not assigned in the case in question 

As the Federal Court of Justice (BGH) noted in its judgment, there was already no valid assignment of the rights to information under the specific contractual agreement. The Senate based its reasoning on the wording of the clause: subparagraph (b) specifically did not provide for an assignment of the rights to information and data portability, but merely for an authorisation to assert them. Since the right to information under Article 15 of the GDPR had therefore not been assigned even under the contractual agreement, the question raised by the Court of Appeal and forming the basis for the leave to appeal – namely, whether the right under Article 15 of the GDPR is transferable at all – did not arise. The Court of Appeal had ruled that the claim was not transferable (Hamm Higher Regional Court (20th Civil Division), judgment of 26 June 2024 – 20 U 337/22). The Federal Administrative Court had also denied the transferability of rights to information under the GDPR in a judgment of 16 September 2020. The Federal Court of Justice expressly rejected the referral to the ECJ suggested in the appeal on the grounds that it was not relevant to the decision. The fundamental question of the assignability of the right to information under Article 15 of the GDPR therefore remains open.

No automatic transfer as a subsidiary right 

According to the Federal Court of Justice, an automatic transfer analogous to Section 401 of the German Civil Code (BGB) is also ruled out. The Senate emphasises that Article 15 of the GDPR constitutes an independent right of transparency and control for the data subject and does not serve merely as a preliminary step towards the enforcement of property claims. The right was not created to enable the data subject to enforce a principal claim, but rather to ensure that they are aware of the processing of their data and can verify its lawfulness. The right to information is neither necessary for the assertion or enforcement of the assigned claims for reimbursement and damages, nor does the separation of the claims jeopardise the enforcement of rights in accordance with the economic allocation of assets or otherwise undermine legal certainty. A transfer as an ancillary right is therefore not justifiable. 

No arbitrary standing to sue 

The discretionary standing, on which the claimant had relied in the alternative in the present case, failed – as had the assignment – due to the specific wording of the contract. According to the Federal Court of Justice, the contractual agreement between the claimant and the policyholders does not authorise the claimant to assert third-party rights to information in its own name. Although the contract authorised the claimant to assert claims for information, it did not authorise it to do so in its own name. The alternative authorisation to ‘enforce in its own name’, also provided for in the contract, related only to claims for reimbursement and damages, but not to the claim for information.

Practical note

With its decision, the Federal Court of Justice – although it leaves open the question of the assignability of the right to information – rejects the instrumentalisation of rights to information under Article 15 of the GDPR in the context of commercial debt enforcement. The right to information under data protection law is a right of the data subject to verify the lawfulness of data processing and not an instrument for debt buyers to obtain information. Companies faced with requests for information from debt purchasers should carefully examine the legal basis on which the request is founded. Is it a claim in their own right, an authorisation on behalf of the data subject, or an alleged assertion by way of representative litigation? This distinction may be decisive for the outcome of the proceedings.

(Federal Court of Justice, judgment of 24 February 2026 – VI ZR 430/24)